input = prepare(raw_data) result = process(input, config={accessibility, aria, audit, color, compliance}) validate(result) deliver(result) ```

Use when monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization. Use when monitoring certificate transparency logs using crt.sh and certstream to detect.

Use when analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.

Use when use the Malpedia platform and API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for detection across malware lineages. Use when working with analyzing malware family relationships with malpedia.

Use when detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports. Use when detecting sandbox evasion techniques in malware samples by analyzing timing.

Use when monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense. Use when monitoring and analyze ransomware group data leak sites (dls) to.

Use when examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes. Use when working with analyzing slack space and file system artifacts.

input = prepare(raw_data) result = process(input, config={ant, charts, component, design, enterprise}) validate(result) deliver(result) ```

Use when automatically clip long videos into short, engaging highlights for TikTok, Reels, and YouTube Shorts using FFmpeg and AI scene detection.

Use when automatically commit and push OpenClaw changes to GitHub. Enable continuous improvement with automatic versioning, changelogs, and deployment-ready commits. Use when working with auto git commiter.

Automated reconnaissance using BBOT (Black Lantern Security's recursive internet scanner). Use when performing bug bounty recon, attack surface management, subdomain enumeration, web.

Use when building or auditing color systems, generating palettes, naming semantic tokens, converting color formats, or measuring contrast ratios.

Use when writing or reviewing interface copy including labels, errors, empty states, confirmations, or ensuring copy matches product voice and guides users.

Use when reverse engineer browser extensions: unpack CRX/XPIs or load unpacked directories, audit manifest permissions for overreach, trace content and background script data flows, extract API endpoints and storage keys, and detect malicious or data-exfiltrating behavior. Use when analyzing extension security posture, suspicious extensions, or extension-based attack chains.

Use when build structured communication templates for malware incidents including stakeholder notifications, executive briefings, technical advisories, and regulatory disclosures with severity-based escalation procedures. Use when building structured communication templates for malware incidents including stakeholder notifications,.

Use when building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T. Use when working with building threat intelligence platform.

input = prepare(raw_data) result = process(input, config={chakra, color, component, composition, library}) validate(result) deliver(result) ```

Use when performing evidence-backed impact analysis before changing code, data, interfaces, or governance documents, then comparing the planned impact with the actual diff after implementation. Covers call paths, data and schema, API contracts, tests, documentation, ADRs, deployment, migration, and rollback. Use for cross-module or high-risk changes, database migrations, authentication, public interfaces, blast-radius questions, pre-change checks, and post-implementation alignment.